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REMARKS 

Applicants acknowledge the indicated allowability of the subject matter of 
Claim 6, as set forth in paragraph 8 of the Office Action. In particular, Claim 6 
would be allowable if rewritten in independent form. However, for the reasons 
set forth hereinafter, Applicants respectfully submit that Claim 6 is allowable in 
its present dependent form. 

In response to the objection to the title of the invention as not descriptive. 
Applicants have revised the title to identify more specifically the invention as 
disclosed and claimed. Accordingly, reconsideration and withdrawal of this 
ground of objection are respectfully requested. 

Claim 1 has been rejected under 35 U.S.C. § 103(a) as unpatentable over 
Sonderman et al (U.S. Patent No. 6,546,508), while Claims 2-6 have been 
rejected as unpatentable over Sonderman et al in view of Gerstung et al (U.S. 
Patent No. 5,436,837). Nevertheless, as discussed in greater detail hereinafter. 
Applicants respectfully submit that all claims currently of record distinguish 
over both Sonderman et al and Gerstung et al, whether considered separately or 
in combination. (Applicants note, that paragraph 4 of the Office Action indicates 
that Claims 2-6 have been rejected over Sonderman et al and Gerstung et al. 
However, in view of the specific indication of the allowability of the subject 
matter of Claim 6 as set forth in paragraph 8 of the Office Action, as well as the 
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Statement of Reasons set forth in paragraph 9, Applicants believe that the 
designation of Claims 2-6 was in error, and that it was intended that only Claims 
2-5 be rejected based on this combination of references.) 

The present invention is directed to an electronic control system of the 
type in which a plurality of control units communicate with each other via a 
communication network (sometimes referred to as "distributed control systems"), 
and in particular, to a method and apparatus for avoiding incorrect transmission 
of data in such a distributed control system. For this purpose, the invention 
provides that, for the transmission of control related data between a first control 
unit and a second control unit in such a distributed control system, a series of 
checks are made to check the integrity of the transmitted data. For this purpose, 
to transmit a control related signal to the second control unit, the first control 
unit initially sends that signal (via a buffer memory) to a third control unit, 
which checks the integrity of the signal, and if the data are correct, returns a 
different set of signals to the first control unit. The first control unit then checks 
the different signals returned by the third control unit, and if the latter are 
correct, only then are the original control related signals transmitted to the 
second control unit. Additional levels of checking are also provided by the second 
control unit, and subsequently once again by the first control unit. If at any step 
amongst these several checks, an error is found in the data, either the first 
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control unit is shut down, the control related signal is not transmitted, or it is 
ignored by the second control unit. 

More specifically, the checks referred to above are carried out as follows: 
initially, before transmitting a control related signal to the second control unit, 
the first control unit generates the control related signal and a second signal 
complementary thereto, on different paths, and sends both signals to a memory, 
together with two additional signals which are indicative of the respective paths 
by which the control related signal and complementary signal were generated. 

A third control unit which is a subscriber to the network then reads out 
the control related and complementary signals, as well as the additional signals 
from the memory, and checks them. Upon detection of an error in any of the 
signals, the third control unit switches off the first control unit. If, however, the 
signals are correct (that is, they contain no errors), the third control unit 
generates a different set of signals and sends them to the memory. 

Thereafter, the first control unit reads out from the memory the different 
set of signals generated by the third control unit, and checks them for integrity. 
If an error is detected in the different set of signals, the first control unit 
switches itself off. If, however, no error is found in the signals, the first control 
unit then emits the control related signal for transmission to the second control 
unit. 
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According to a further embodiment of the invention, at the time when the 
first control unit emits the control related signal for transmission to the second 
control unit, it also generates a further signal comprising a prescribed selection 
of the different signals generated by the third control unit, and sends the further 
signal to the second control unit along with the control related signal. The 
second control unit then tests the further signal and, if an error is found therein, 
disregards the control related signals which accompany them. On the other 
hand, if there is no error in the further signals, the second control unit obeys the 
control related signal transmitted by the first control unit. 

Still a further embodiment provides yet another level of checking, in that, 
after it has verified the correctness of the signals which it has received, the 
second control unit returns to the first control unit an acknowledgment signal 
that is correlated to the received control related signal. The first control unit 
then checks the acknowledgement signal and switches the control system to an 
emergency operating or standby operating mode if an error is detected in the 
acknowledgement signal. 

Finally, in still another embodiment of the invention, the control related 
signal and the additional signals generated by the third control unit are stored 
in a buffer, which then returns them to the first control unit. The latter 
compares these signals to the signals as set, and turns itself off in the event of a 
deviation. 
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Each of the above several layers of the checking procedure implemented in 
the electronic control unit according to the invention is recited in the claims of 
the application. 

In contrast to the present invention, the Sonderman et al reference 
discloses a method and apparatus for detecting faulty operation of a processing 
tool, such as a semiconductor fabrication device, based on "operational state 
data" which characterize the current operating state of the tool. (Column 2, lines 
38-42.) Such "operational state data" may include, for example, "temperature, 
pressure, and gas flow measurements from the processing tool". (Column 2, lines 
61-62.) The tool operational state data are communicated to an Advance Process 
Control (APC) framework to determine whether the tool is experiencing faulty 
operation. (Column 2, lines 55-59.) For this purpose, a fault detection unit 125 
compares the tool operational state data (relayed and reformatted by the APC 
framework 120) to "fault model data". The latter is simply a collection of tool 
state data of "other similar-type tools, where it was previously known that such 
tools have operated within acceptable operational limits". (Column 3, lines 42- 
46; Column 5, lines 61-63.) In other words, the fault detection unit 125 compares 
data such as temperature, pressure and gas flow measurements from the 
processing tool 105 to data from similar equipment which was known to be 
working properly, and determines whether the current temperature, pressure 
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and gas flow measurements (for example) are such as to imply that the tool is 
operating properly. 

In addition to the operational state data forwarded by the tool itself an 
add-on sensor 115 may also be coupled to the processing tool to measure 
additional tool state data which cannot be determined by the tool. For example, 
the add-on sensor 115 could be used to determine whether the silicon wafer was 
produced within acceptable operational limits by the tool 105. The latter in turn 
depends on whether the tool produced the wafer within an acceptable 
temperature range. In all events, however, the information from the sensor 115 
is transmitted as "operational state data" together with the information provided 
by the tool itself, and used to compare with the fault model data to determine 
that the tool is operating properly. 

As can be seen from the foregoing brief description, the Sonderman et al 
apparatus differs fundamentally from the present invention, in at least the 
following particulars. 

1. It does not disclose an electronic control system for transmission of 
a control-related signal from a first control unit to a second control 
unit, as recited in Claim 1. 

2. It does not provide for a first control unit generating a control- 
related signal and a second signal complementary thereto on 
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different paths, nor does it provide for transmitting two additional 
signals which are indicative of the respective different paths by 
which the first two signals were generated. It is noteworthy in this 
regard that the "operational state data" in Sonderman et al are 
nothing more than diagnostic operating parameter data for the tool. 
They do not constitute a control-related signal that is to be 
transmitted to a second control unit. Moreover, given the nature of 
the operational state data, there would be no utility at all in 
providing for the generation of a signal complementary thereto on a 
different path, or for information regarding the paths on which the 
two signals were generated. 

Sonderman et al also does not disclose that a third control unit 
reads out the control related and complementary signals and the 
additional signals transmitted by the first control unit and checks 
those signals for errors therein. Indeed, given the nature of the 
signals, and the overall purpose of the Sonderman et al apparatus, 
there would be no need for or detecting errors in the signal. Rather, 
Sonderman et al merely looks for errors in operation of the 
processing tool. 

Sonderman et al also contains no suggestion that the third control 
unit, having verified the correctness of the signals which it received, 
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"generates different types of tests or safety signals" and sends them 
back to the first control unit by a memory. 

5. Sonderman et al also contains no suggestion that the first control 
unit then reads out the test or safety data signals generated by the 
third control unit and tests for errors in the latter signals, all as 
recited in Claim 1, and in method Claim 7. 

Claims 2 through 5 and 8 through 1 1 define additional tests performed by 
the method and apparatus according to the invention, none of which finds a 
corresponding provision in the Sonderman et al reference. 

Paragraph 3a of the Office Action suggests that in Sonderman et al, "state 
data" are transmitted along with "operational state data", referring to Column 1, 
lines 45-53 and 60-67. As can be seen from the above description, however, in 
Sonderman et al, the terms "state data" and "operational state data" are used 
interchangeably, and refer to the same quantity, being simply the operating 
parameters of temperature, pressure and gas flow measurements, etc. 

Paragraph 3a of the Office Action also indicates that in Sonderman et al, 
the "fault detection unit compares the received tool state data to the fault model 
data, also received". Applicants are uncertain what significance is attributed to 
the words "also received", but it is clear from the disclosure in Sonderman et al 
that these data merely constitute a collection of operating parameters data from 
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properly operating tools, which presumably are stored somewhere in the system. 
In particular, they do not correspond to the "additional signals" defined, for 
example, in Claim 1. 

In summary, while the present invention provides a multi-tiered checking 
procedure for verifying the integrity of control-related signals transmitted in a 
distributing control system, Sonderman et al merely checks the operational 
status of a processing tool. It is unconcerned with the integrity of the 
transmitted data and uses a checking technique which is altogether different 
from that of the present application. 

The Gerstung et al reference, on the other hand, discloses a system for 
monitoring a control device in a motor vehicle, in which a monitoring device is 
coupled to the control device. The control device receives "first data" and 
determines "second data" based thereon in accordance with a predetermined test 
function. The monitoring device also receives the "first data and determines 
"third data" based thereon in accordance with the same test function. The 
second and third data are then compared in order to detect a malfunction in the 
system, based on whether the data matches. (See Column 1, lines 46-57.) In 
other words, the monitoring device performs a redundant checking operation 
which parallels that of the control device, and if the two results (the second data 
and third data) match, then there is an extremely high probability that both the 
control device and the monitoring device are working properly. 
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Like Sonderman et al, Gerstung et al fails to teach or suggest a 
distributed electronic control system such as defined in the claims of the present 
application, in which a multi-level hierarchical test regime can be performed, 
based on the proposition that the data as originally generated by a first control 
unit includes not only a control-related signal, but also a second signal 
complementary to the control-related signal, which is generated on a different 
path within the first control unit, and also that the first control unit sends two 
additional signals which are indicative of the respective paths used to generate 
the control-related signal and its complement. The information contained in the 
latter signals makes it possible to check the internal integrity of the signals 
themselves, in a manner which is neither taught nor suggested by Gerstung et 
al. Accordingly, Gerstung et al contains no disclosure which teach or suggest a 
modification of Sonderman et al to replicate the present invention. 

In light of the foregoing remarks, this application should be in condition 
for allowance, and early passage of this case to issue is respectfully requested. If 
there are any questions regarding this amendment or the application in general, 
a telephone call to the undersigned would be appreciated since this should 
expedite the prosecution of the application for all concerned. 

If necessary to effect a timely response, this paper should be considered as 
a petition for an Extension of Time sufficient to effect a timely response, and 
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please charge any deficiency in fees or credit any overpayments to Deposit 
Account No. 05-1323 (Docket #225/49620). 

Respectfully submitted, 

Gary R.^dwards 
Registration No. 31,824 

CROWELL & MORING LLP 
Intellectual Property Group 
P.O. Box 14300 
Washington, DC 20044-4300 
Telephone No.: (202) 624-2500 
Facsimile No.: (202) 628-8844 
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